Soxoj and GitHub
dbbc8adf5a
Add system settings path and document offline test runs ( #2974 )
...
* Add /etc/maigret/settings.json to the settings search path
* Register the slow marker and document offline test runs
2026-08-15 19:41:06 +02:00
Soxoj and GitHub
e1c80a7a42
Move snapcraft.yaml to snap/, migrate to core24 ( #2975 )
2026-08-15 19:40:31 +02:00
Soxoj and GitHub
d7f759a239
Keep runtime activation tokens out of the sites database ( #2973 )
...
* Keep runtime activation tokens out of the sites database
* Document the activation token cache
2026-08-15 12:43:30 +02:00
203e26cc2f
Updated site list and statistics ( #2972 )
...
Co-authored-by: soxoj <31013580+soxoj@users.noreply.github.com >
2026-08-15 12:09:53 +02:00
Kaif and GitHub
c934693fce
fix: probe HuggingFace via the API endpoint ( #2957 )
...
The profile route returns 200 for reserved paths (models, pricing, docs) and for
organization pages, so all of them were reported as user accounts. Checking
/api/users/{username}/overview instead returns 404 for those, while `url` stays
the profile page so reports keep linking to a readable page.
2026-08-14 22:13:59 +02:00
felipe and GitHub
b84d61331f
ci: publish dev builds as nightly prereleases ( #2959 ) ( #2963 )
2026-08-14 22:10:53 +02:00
Soxoj and GitHub
23077d2025
Update of README ( #2971 )
2026-08-14 16:09:17 +02:00
ac03d4013d
build(deps): bump platformdirs from 4.11.1 to 4.11.2 ( #2970 )
...
Bumps [platformdirs](https://github.com/tox-dev/platformdirs ) from 4.11.1 to 4.11.2.
- [Release notes](https://github.com/tox-dev/platformdirs/releases )
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst )
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.1...4.11.2 )
---
updated-dependencies:
- dependency-name: platformdirs
dependency-version: 4.11.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-14 09:19:29 +02:00
Soxoj and GitHub
b69f70f942
Add "Fork me on GitHub" ribbon to web interface ( #2969 )
2026-08-12 23:10:12 +02:00
felipe and GitHub
46c90bd2cc
docs: link to socid-extractor readthedocs pages ( #2927 ) ( #2967 )
2026-08-12 17:15:58 +02:00
b6fe0cd0e3
Fix ReverbNation false-positive check ( #2929 )
...
Co-authored-by: Julio César Suástegui <juliosuas@users.noreply.github.com >
2026-08-12 17:10:06 +02:00
da6e498872
build(deps): bump pyinstaller from 6.21.0 to 6.22.0 ( #2964 )
...
Bumps [pyinstaller](https://github.com/pyinstaller/pyinstaller ) from 6.21.0 to 6.22.0.
- [Release notes](https://github.com/pyinstaller/pyinstaller/releases )
- [Changelog](https://github.com/pyinstaller/pyinstaller/blob/develop/doc/CHANGES.rst )
- [Commits](https://github.com/pyinstaller/pyinstaller/compare/v6.21.0...v6.22.0 )
---
updated-dependencies:
- dependency-name: pyinstaller
dependency-version: 6.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-12 17:06:13 +02:00
felipe and GitHub
77b565cfd5
fix: normalize SOCKS5 proxy scheme per HTTP transport ( #2955 ) ( #2966 )
2026-08-12 17:04:32 +02:00
Soxoj
e0dbef865c
Improved release documentation
2026-08-11 18:57:43 +02:00
Soxoj and GitHub
089f5abe9a
Bump to 0.6.4 ( #2960 )
2026-08-11 18:18:35 +02:00
Soxoj and GitHub
8518622933
Fix site checks: 9 fixed, 4 disabled; git hook update ( #2956 )
...
Closes #2941 , #2950 , #2918 , #2913 , #2905 , #2897
2026-08-11 15:51:31 +02:00
Soxoj and GitHub
fbda9cdfcc
fix: retry transient network/proxy errors in site checkers ( #2954 )
...
Rotating/residential proxies often drop a connection mid-request
(truncated body, closed socket, failed handshake) instead of failing
outright. These were previously lumped into "Unexpected" and never
retried, silently discarding otherwise-successful checks.
- Retry once on ClientPayloadError, ServerDisconnectedError, and
aiohttp_socks' ProxyConnectionError/ProxyTimeoutError (aiohttp
checker), and on CurlError (curl_cffi checker) — covers truncated
responses, dropped connections, CONNECT-tunnel 502s, and TLS
handshake failures.
- Fix the proxy-error except clause: it caught python_socks'
ProxyError, but aiohttp_socks (the connector actually in use)
raises its own unrelated same-named exceptions, so it never fired.
- Generic ProxyError (e.g. bad credentials) is classified but NOT
retried — it fails identically every attempt.
2026-08-11 13:16:13 +02:00
Soxoj and GitHub
af13058cfe
Update sponsorship information ( #2953 )
2026-08-11 11:14:46 +02:00
Soxoj and GitHub
5387790810
Improved documentation, added quick link to deploy Maigret web to Readme ( #2952 )
...
* Improved documentation, added quick link to deploy Maigret web to Readme
* Move Render config file to utils/
2026-08-11 10:56:16 +02:00
fea4759a03
build(deps): bump platformdirs from 4.11.0 to 4.11.1 ( #2951 )
...
Bumps [platformdirs](https://github.com/tox-dev/platformdirs ) from 4.11.0 to 4.11.1.
- [Release notes](https://github.com/tox-dev/platformdirs/releases )
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst )
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.0...4.11.1 )
---
updated-dependencies:
- dependency-name: platformdirs
dependency-version: 4.11.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 09:31:36 +02:00
Julio César Suástegui and GitHub
34a1669974
Fix XMind reports for modern readers ( #2930 )
...
* fix(report): add XMind manifest for modern readers
* docs: document modern XMind reader compatibility
2026-08-10 22:54:35 +02:00
e468267146
Updated site list and statistics ( #2949 )
...
Co-authored-by: soxoj <31013580+soxoj@users.noreply.github.com >
2026-08-10 20:19:04 +02:00
819ceed272
fix: use /data/profile urlProbe for Instapaper false-positive ( #2915 ) ( #2937 )
...
Co-authored-by: Soxoj <31013580+soxoj@users.noreply.github.com >
2026-08-10 19:14:30 +02:00
7c34b8042a
build(deps): bump pypdf from 6.14.2 to 6.15.0 ( #2943 )
...
Bumps [pypdf](https://github.com/py-pdf/pypdf ) from 6.14.2 to 6.15.0.
- [Release notes](https://github.com/py-pdf/pypdf/releases )
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md )
- [Commits](https://github.com/py-pdf/pypdf/compare/6.14.2...6.15.0 )
---
updated-dependencies:
- dependency-name: pypdf
dependency-version: 6.15.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 11:45:37 +02:00
9d6c7cc897
build(deps): update chardet requirement from >=7.4.3 to >=7.5.1 ( #2944 )
...
Updates the requirements on [chardet](https://github.com/chardet/chardet ) to permit the latest version.
- [Release notes](https://github.com/chardet/chardet/releases )
- [Changelog](https://github.com/chardet/chardet/blob/main/docs/changelog.rst )
- [Commits](https://github.com/chardet/chardet/compare/7.4.3...7.5.1 )
---
updated-dependencies:
- dependency-name: chardet
dependency-version: 7.5.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 11:45:17 +02:00
5f3e6dec4d
build(deps): bump soupsieve from 2.9.1 to 2.9.2 ( #2945 )
...
Bumps [soupsieve](https://github.com/facelessuser/soupsieve ) from 2.9.1 to 2.9.2.
- [Release notes](https://github.com/facelessuser/soupsieve/releases )
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.9.1...2.9.2 )
---
updated-dependencies:
- dependency-name: soupsieve
dependency-version: 2.9.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 11:45:06 +02:00
c295c1cade
build(deps-dev): bump coverage from 7.15.3 to 7.15.4 ( #2946 )
...
Bumps [coverage](https://github.com/coveragepy/coveragepy ) from 7.15.3 to 7.15.4.
- [Release notes](https://github.com/coveragepy/coveragepy/releases )
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst )
- [Commits](https://github.com/coveragepy/coveragepy/compare/7.15.3...7.15.4 )
---
updated-dependencies:
- dependency-name: coverage
dependency-version: 7.15.4
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 11:44:57 +02:00
Soxoj and GitHub
1171dbdb84
Sponsorship details update in README ( #2939 )
2026-08-08 02:07:11 +07:00
67c8df1757
Updated site list and statistics ( #2935 )
...
Co-authored-by: soxoj <31013580+soxoj@users.noreply.github.com >
2026-08-07 17:09:36 +09:00
c9d58de7ca
build(deps): bump curl-cffi from 0.15.0 to 0.16.0 ( #2931 )
...
Bumps [curl-cffi](https://github.com/lexiforest/curl_cffi ) from 0.15.0 to 0.16.0.
- [Release notes](https://github.com/lexiforest/curl_cffi/releases )
- [Changelog](https://github.com/lexiforest/curl_cffi/blob/main/docs/changelog.rst )
- [Commits](https://github.com/lexiforest/curl_cffi/compare/v0.15.0...v0.16.0 )
---
updated-dependencies:
- dependency-name: curl-cffi
dependency-version: 0.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-06 19:18:19 +09:00
cfa18a380f
build(deps): bump svglib from 2.0.2 to 2.1.0 ( #2933 )
...
Bumps [svglib](https://github.com/deeplook/svglib ) from 2.0.2 to 2.1.0.
- [Release notes](https://github.com/deeplook/svglib/releases )
- [Changelog](https://github.com/deeplook/svglib/blob/main/CHANGELOG.md )
- [Commits](https://github.com/deeplook/svglib/compare/v2.0.2...v2.1.0 )
---
updated-dependencies:
- dependency-name: svglib
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-06 19:17:59 +09:00
2ca87d0b87
build(deps): bump cryptography from 48.0.1 to 50.0.0 ( #2932 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 48.0.1 to 50.0.0.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/48.0.1...50.0.0 )
---
updated-dependencies:
- dependency-name: cryptography
dependency-version: 50.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-06 19:17:24 +09:00
69ea495fa1
build(deps-dev): bump coverage from 7.15.2 to 7.15.3 ( #2934 )
...
Bumps [coverage](https://github.com/coveragepy/coveragepy ) from 7.15.2 to 7.15.3.
- [Release notes](https://github.com/coveragepy/coveragepy/releases )
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst )
- [Commits](https://github.com/coveragepy/coveragepy/compare/7.15.2...7.15.3 )
---
updated-dependencies:
- dependency-name: coverage
dependency-version: 7.15.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-06 19:16:59 +09:00
75baf29b02
Fix Omg.lol false-positive check ( #2922 )
...
Co-authored-by: Soxoj <31013580+soxoj@users.noreply.github.com >
2026-08-03 08:49:45 +09:00
Sanjay Santhanam and GitHub
e08310da87
fix: don't let the SUPPORTED_IDS branch re-add a rejected username in extract_ids_from_page ( #2924 )
...
extract_ids_from_page() has the same bug #2907 fixed in
checking.py::parse_usernames(). "username" is itself in SUPPORTED_IDS, so
the `if k in SUPPORTED_IDS` loop stores a bare `username` value directly,
bypassing the is_plausible_username() guard that extract_usernames()
applies in its own separate pass. A URL or email returned by
socid_extractor under a bare `username` key therefore becomes a recursive
search target via `maigret --parse-url`, reproducing the #1403
false-error cascade.
Skip keys containing "username" in the SUPPORTED_IDS loop; those are
already owned (and validated) by extract_usernames(). Every other
SUPPORTED_ID (gaia_id, vk_id, orcid, ...) is unaffected since none of
those keys contain "username".
Add regression tests for the bare `username` key with a URL value and for
the unchanged handling of other supported IDs.
Closes #2911
2026-08-03 08:43:50 +09:00
Soxoj and GitHub
d1b8b9fa5c
Web interface update: live scan, settings perseistence, history, nagivation ( #2925 )
2026-08-03 08:41:07 +09:00
9b6c5381fa
Updated site list and statistics ( #2921 )
...
Co-authored-by: soxoj <31013580+soxoj@users.noreply.github.com >
2026-08-03 02:24:35 +09:00
zsxh1990 and GitHub
6fa6b6d4c5
fix: disable PulmonaryHypertensionNews (false-positive, 403 protection) ( #2917 )
...
Closes #2916
Site returns 403 for all usernames (both claimed and unclaimed).
The site is behind TLS fingerprint protection and cannot be reliably checked.
Disabled to prevent false-positive results.
Signed-off-by: zsxh1990 <445655361@qq.com >
2026-08-02 12:15:13 +09:00
b186b77974
[ImgBot] Optimize images ( #2912 )
...
*Total -- 813.59kb -> 719.41kb (11.58%)
/static/web_interface_screenshot_start.png -- 312.48kb -> 274.81kb (12.06%)
/static/web_interface_screenshot.png -- 501.11kb -> 444.61kb (11.28%)
Signed-off-by: ImgBotApp <ImgBotHelp@gmail.com >
Co-authored-by: ImgBotApp <ImgBotHelp@gmail.com >
2026-07-28 01:32:13 +05:00
Soxoj and GitHub
c2e24f3218
Fix site checks: 9 fixed, 1 disabled ( #2914 )
2026-07-28 01:31:57 +05:00
Ashvin and GitHub
0fd5bf66e8
fix: block SSRF / local-file reads via report image URLs during PDF generation ( #2908 )
...
* fix: block SSRF and local-file reads via report image URLs in PDF generation
save_pdf_report() rendered scraped profile image URLs (ids_data['image'])
straight into xhtml2pdf, which fetches <img src> while building the PDF.
The image field is attacker-influenced and pisaDocument ran with no
link_callback, so a profile carrying image = "file:///etc/passwd" or an
intranet/metadata URL turned report generation into a local file read or
an SSRF from the machine running maigret. In the web UI this is
server-side and fires on every search, since save_pdf_report is always
called.
Add a link_callback that only lets public http(s) images through and
diverts everything else (file://, data:, other schemes, and hosts that
resolve to loopback/private/link-local/reserved addresses) to a bundled
1x1 placeholder, so no fetch or read happens. Diverting rather than
raising keeps report generation working when a scanned profile carries a
hostile image URL.
Tests cover the URL classifier, the callback's placeholder diversion, and
an end-to-end check that PDF generation does not fetch an internal image.
* fix: use is_global to also block CGNAT (100.64.0.0/10) report image hosts
The flag chain missed 100.64.0.0/10, which is neither is_private nor
is_global and is routable inside many cloud and k8s networks. is_global
covers it along with private, loopback, link-local and unspecified.
Multicast and reserved stay explicit: both are still is_global on
CPython, and 64:ff9b::/96 reaches IPv4 through a NAT64 gateway.
2026-07-27 17:57:08 +05:00
Ashvin and GitHub
76c994f7bc
fix: don't let the SUPPORTED_IDS branch re-add a rejected username ( #2907 )
...
parse_usernames() validates *_username fields with is_plausible_username
(the #1403 guard), but the trailing `if k in SUPPORTED_IDS` branch runs
unconditionally. Since "username" is itself in SUPPORTED_IDS, the bare
`username` key bypasses the guard: a URL/email/path value is dropped by
the plausibility check and then silently re-added, so it becomes a
recursive search target again and reproduces the #1403 false-error
cascade.
Make the branch an elif. The bare `username` key is already handled with
validation by the first branch; every other SUPPORTED_ID (gaia_id,
vk_id, orcid, ...) still gets added as before since none of those keys
contain "username".
Add a regression test for the bare `username` key with URL/email/path
values; the existing parse_usernames tests only covered *_username
variants, which aren't in SUPPORTED_IDS.
2026-07-27 12:36:30 +05:00
1d2eb39462
Updated site list and statistics ( #2910 )
...
Co-authored-by: soxoj <31013580+soxoj@users.noreply.github.com >
2026-07-27 12:07:58 +05:00
Soxoj and GitHub
8b263dc960
Fix site checks: 3 fixed, 2 dead deleted ( #2909 )
2026-07-27 12:02:24 +05:00
986a16b228
build(deps): bump pypdf from 6.13.3 to 6.14.2 ( #2904 )
...
Bumps [pypdf](https://github.com/py-pdf/pypdf ) from 6.13.3 to 6.14.2.
- [Release notes](https://github.com/py-pdf/pypdf/releases )
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md )
- [Commits](https://github.com/py-pdf/pypdf/compare/6.13.3...6.14.2 )
---
updated-dependencies:
- dependency-name: pypdf
dependency-version: 6.14.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-25 03:10:05 +05:00
33140dae27
build(deps): bump aiohttp from 3.14.2 to 3.14.3 ( #2903 )
...
Bumps [aiohttp](https://github.com/aio-libs/aiohttp ) from 3.14.2 to 3.14.3.
- [Changelog](https://github.com/aio-libs/aiohttp/blob/v3.14.3/CHANGES.rst )
- [Commits](https://github.com/aio-libs/aiohttp/compare/v3.14.2...v3.14.3 )
---
updated-dependencies:
- dependency-name: aiohttp
dependency-version: 3.14.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-24 19:14:14 +05:00
094b3f74ed
build(deps): bump platformdirs from 4.10.1 to 4.11.0 ( #2898 )
...
Bumps [platformdirs](https://github.com/tox-dev/platformdirs ) from 4.10.1 to 4.11.0.
- [Release notes](https://github.com/tox-dev/platformdirs/releases )
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst )
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.10.1...4.11.0 )
---
updated-dependencies:
- dependency-name: platformdirs
dependency-version: 4.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 10:18:39 +05:00
81f9ecdd0e
build(deps): bump certifi from 2026.6.17 to 2026.7.22 ( #2899 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.6.17 to 2026.7.22.
- [Commits](https://github.com/certifi/python-certifi/compare/2026.06.17...2026.07.22 )
---
updated-dependencies:
- dependency-name: certifi
dependency-version: 2026.7.22
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-22 12:23:47 +05:00
58db3c9773
build(deps): bump soupsieve from 2.9 to 2.9.1 ( #2900 )
...
Bumps [soupsieve](https://github.com/facelessuser/soupsieve ) from 2.9 to 2.9.1.
- [Release notes](https://github.com/facelessuser/soupsieve/releases )
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.9...2.9.1 )
---
updated-dependencies:
- dependency-name: soupsieve
dependency-version: 2.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-22 12:23:02 +05:00
fa384bdab8
build(deps): bump pillow from 12.2.0 to 12.3.0 ( #2896 )
...
Bumps [pillow](https://github.com/python-pillow/Pillow ) from 12.2.0 to 12.3.0.
- [Release notes](https://github.com/python-pillow/Pillow/releases )
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst )
- [Commits](https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0 )
---
updated-dependencies:
- dependency-name: pillow
dependency-version: 12.3.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 10:05:08 +02:00
